Encrypted malicious traffic detection method and system, and computer readable storage medium

Abstract

The invention discloses an encrypted malicious traffic detection method and system and a computer readable storage medium, and belongs to the technical field of traffic detection. The encrypted malicious traffic detection method comprises the following steps: acquiring original network traffic data, and constructing a packet length sequence and a packet arrival time interval sequence to form an original time sequence matrix; and extracting a time-frequency energy distribution diagram and a frequency band energy sequence from the packet length sequence through continuous wavelet transform. A time domain time sequence convolution network based on an expansion causal convolution structure is adopted, and a time domain feature vector is extracted from an original time sequence matrix. And extracting frequency domain feature vectors from the time-frequency energy distribution diagram and the frequency band energy sequence by adopting a time-frequency attention and frequency band re-scaling attention module. And performing malicious traffic dichotomy and malicious traffic behavior type multi-classification processing on the time-frequency aggregation feature vector through a hierarchical classifier, and outputting a classification result. According to the scheme, the malicious traffic characterization capability of deep fusion of time-frequency features is realized, and the detection precision of the encrypted malicious traffic is improved.

Description

Technical Field

[0001] This invention relates to the field of traffic detection technology, and in particular to an encrypted malicious traffic detection method, system, and computer-readable storage medium. Background Technology

[0002] Encrypted malicious traffic detection is a crucial component of network security defense systems. It aims to identify malicious behaviors hidden within encrypted communications, such as malware transmission, command and control channels, and data leakage tunnels, through in-depth analysis and modeling of encrypted network traffic data. Traditional detection methods based on plaintext traffic analysis cannot be directly applied to encrypted traffic analysis; therefore, research into encrypted traffic detection technology has significant practical implications. Existing encrypted malicious traffic detection methods can be mainly categorized into methods based on traffic statistical features, methods based on traditional machine learning, and methods based on deep learning.

[0003] Methods based on traffic statistics extract statistical information such as traffic packet length and arrival time interval, and then combine it with threshold judgment or rule matching for detection. Methods based on traditional machine learning use traditional machine learning methods such as support vector machines and random forests for classification based on extracted statistical features. The feature engineering of the above methods mainly relies on manual design.

[0004] In recent years, deep learning-based methods have become a research hotspot due to their powerful feature learning capabilities. These methods use raw traffic sequences as input and employ deep learning models such as convolutional neural networks (CNNs) and recurrent neural networks (RNNs) to detect malicious encrypted traffic. However, existing deep learning-based methods for detecting malicious encrypted traffic still have the following limitations: First, feature extraction is limited in dimension; most methods analyze traffic sequences only from a time-domain perspective, ignoring key pattern information such as periodicity and burstiness contained in the frequency domain, resulting in insufficient feature representation. Second, the temporal modeling mechanism is weak; most methods rely on recurrent neural networks or their variants to handle temporal dependencies, leading to low training efficiency, difficulties in gradient propagation over long sequences, and challenges in effectively integrating time-domain and frequency-domain features for joint modeling. Summary of the Invention

[0005] The technical problem to be solved by the present invention is to provide an encrypted malicious traffic detection method, system and computer-readable storage medium that address the above-mentioned deficiencies of the prior art.

[0006] To achieve the above objectives, the present invention provides a method for detecting encrypted malicious traffic, the method comprising the following steps: The raw network traffic data is acquired, preprocessed, and serialized to construct packet length sequences and packet arrival time interval sequences to form the original time series matrix; the time-frequency energy distribution map and frequency band energy sequence are extracted from the packet length sequences through continuous wavelet transform. A time-frequency enhancement detection model is constructed based on the original time-series matrix, time-frequency energy distribution map, and frequency band energy sequence. The time-frequency enhancement detection model includes a time-domain temporal convolutional network channel and a frequency domain enhancement channel. The time-domain temporal convolutional network channel is based on a time-domain temporal convolutional network with an extended causal convolutional structure to extract time-domain feature vectors from the original time-series matrix. The frequency domain enhancement channel is based on time-frequency attention and frequency band rescaling attention modules to extract frequency domain feature vectors from the time-frequency energy distribution map and the frequency band energy sequence. The time-domain feature vector and the frequency-domain feature vector are fused to obtain a time-frequency aggregated feature vector; The time-frequency aggregated feature vector is processed by a hierarchical classifier to perform binary classification of malicious traffic and multi-class classification of malicious traffic behavior types, and the classification results are output.

[0007] In the encrypted malicious traffic detection method of the present invention, the specific method for performing data preprocessing and session serialization to construct packet length sequences and packet arrival time interval sequences to form the original time series matrix is ​​as follows: Key fields are extracted from the raw network traffic data, including timestamp, source IP address, destination IP address, source port, destination port, protocol type, and packet length. Each raw packet contains a 5-tuple (source IP address, destination IP address, source port, destination port, protocol type) and a timestamp. Packets under the same 5-tuple are sorted in ascending order of timestamp, and the time interval between adjacent packets is calculated. If the time interval is greater than a preset flow timeout threshold, session segmentation is performed at this point. Finally, the packet sequence under the 5-tuple is divided into multiple session units. Each session in a session unit contains multiple consecutive packets, and adjacent sessions within the same session unit satisfy the intra-session continuity constraint. For each session, the packet length sequence is extracted. Packet arrival time interval sequence To standardize input length and adapt to model processing, a fixed sequence length is set. If the actual sequence length Fill the end of the sequence with zero values; if Extracting the first part of the sequence from the position Each session is represented by an element; ultimately, each session is represented as a two-dimensional time-series matrix. The first column is the packet length sequence, the second column is the arrival time interval sequence, and all sequences are standardized.

[0008] In the encrypted malicious traffic detection method of the present invention, the specific method for extracting the time-frequency energy distribution map and the frequency band energy sequence from the packet length sequence through continuous wavelet transform is as follows: Using the complex Morlet wavelet as the mother function, it is expressed as: ,in For the center frequency, Let time be the variable; let the scale set be... The corresponding frequency band range is ,scale With frequency The relationship is ,in, The wavelet center frequency, The sampling interval is [specified]. This applies to the standardized packet length sequence. Perform a continuous wavelet transform to obtain the wavelet coefficient matrix. Its matrix elements are represented as: ,in, This serves as a scale index, corresponding to different frequency scales; This is the time index, corresponding to the th in the packet length sequence. One sampling point; This represents the complex conjugate of the wavelet mother function. Taking the modulus of the wavelet coefficients yields the time-frequency energy distribution map. , represented as Calculate the average energy at each scale to obtain the frequency band energy sequence. : .

[0009] In the encrypted malicious traffic detection method of the present invention, the temporal-domain temporal convolutional network channel is based on a temporal-domain temporal convolutional network with an extended causal convolutional structure. The specific method for extracting temporal feature vectors from the original temporal matrix is ​​as follows: The original time series matrix is ​​processed by a one-dimensional convolutional layer with a kernel size of 1. Mapping to Dimensions To form initial feature representation Specifically, it is expressed as: Assume that the temporal convolutional network has a total of Each layer consists of a dilated causal convolutional layer, a weight normalization layer, a ReLU activation function, and a DropOut layer; Layer expansion rate Set as The kernel size is fixed. For input to the first The features of a layer are represented as ,in Given the input feature dimension, the output feature of this layer is... Represented as: ,in, It is the first Layer The convolution kernel weight matrix at each position; It is the first Layer bias vector; It is the index of the current time step; It is the output feature channel index; This indicates a weight normalization operation; This is the activation function. Additionally, a residual connection is introduced between every two convolutional layers, passing the original input through a... After dimension matching, the convolution is added to the output of the convolutional layer, as shown below: .go through After stacking layers of temporal convolutional networks, the output of the last layer is... Global average pooling is performed along the time dimension to aggregate the contextual information of the entire sequence, resulting in a fixed-dimensional temporal feature vector. : ,in, is the dimension of the time-domain feature vector.

[0010] In the encrypted malicious traffic detection method of the present invention, the frequency domain enhancement channel is based on time-frequency attention and frequency band rescaling attention modules. The specific method for extracting frequency domain feature vectors from the time-frequency energy distribution map and the frequency band energy sequence is as follows: Through a Two-dimensional convolutional layer time-frequency energy distribution map Perform preliminary feature extraction: ,in, The initial number of channels. Based on the time-frequency attention module, features are processed through a channel attention mechanism. Global average pooling and global max pooling are performed along the time-frequency dimension to obtain two different channel description vectors. and : Input the two channel description vectors into a shared multilayer perceptron, and output the channel attention weights. , represented as ,in The channel attention weights are applied to the initial time-frequency energy distribution map features, using the Sigmoid function. : Features are addressed through spatial attention mechanisms. Simultaneously apply average pooling and max pooling along the channel dimension to obtain two distinct spatial feature maps, and then concatenate them: Spatial attention weights are learned through a two-dimensional convolutional layer. , represented as Apply spatial attention weights: Features of the enhanced time-frequency energy distribution map Perform global average pooling to obtain the feature vector of the time-frequency attention module branch: Learnable band rescaling of the frequency band energy sequence adaptively adjusts the importance of each band, as expressed in: ;in, These are trainable parameters. A fully connected layer maps the rescaled sequence into query, key, and value vectors: ;in, Both are learnable weight matrices and bias vectors. The attention weights for each frequency band are calculated as follows: ;in, Given a vector dimension; the feature vectors of the frequency band rescaling attention module branches are obtained through weighted aggregation: ;in, It is the output dimension of the value vector. It incorporates the branch features of the time-frequency attention module. Frequency band rescaling attention module branch features Projected to the same dimension : The above feature vectors are then weighted and fused to calculate the fusion weights for the two branches: ;in, It is a learnable weight vector, and The final weighted fusion yields the frequency domain feature vector. : .

[0011] In the encrypted malicious traffic detection method of the present invention, the specific method for fusing the time-domain feature vector and the frequency-domain feature vector to obtain the time-frequency aggregated feature vector is as follows: The time-domain feature vector and the frequency domain feature vector spliced ​​together : A gated vector is generated through a fully connected layer. : ;in It is the Sigmoid function. These are learnable parameters. It is the feature dimension after fusion. The temporal feature vector... and frequency domain eigenvectors Dimension matching is performed through a linear layer. Dimension, output is represented as and Weighted fusion is performed using gated vectors to obtain a fused feature vector. : Construct three parallel one-dimensional convolutional branches, with their dilation rates set to... The different receptive field sizes are represented as follows: ;in This refers to the kernel size of each branch. The output features of the three branches are concatenated along the channel dimension to obtain the final time-frequency aggregated feature vector output by the time-frequency enhanced temporal convolutional network. : ;in It is the total dimension of the features after splicing.

[0012] In the encrypted malicious traffic detection method of the present invention, the specific method for performing binary classification of malicious traffic and multi-classification of malicious traffic behavior types on the time-frequency feature vector using a hierarchical classifier, and outputting the classification results, is as follows: The hierarchical classifier's network structure consists of a shared feature extraction layer and two classification heads. The first-level classification head performs binary classification, while the second-level classification head further classifies traffic deemed "malicious" by the first-level head into its specific type. The shared feature extraction layer includes a fully connected layer, a ReLU activation function, and a DropOut layer, and aggregates time-frequency feature vectors. As input, it is represented as: ;in, Here are the weight matrix and bias vector. The classification head consists of a fully connected layer and a Softmax activation function. The first-level classification head outputs a binary classification probability vector, represented as: The second-level classification header outputs one... Class probability vector, The total number of malicious types is represented as: Let the output probability vector of the first-level classifier be... ,in The probability is for the "normal" class. The probability is for the "malicious" class; the second-level classification head outputs the probability vector as follows: ,correspond One malicious type; the final encrypted malicious traffic prediction label is determined by the following rules: .

[0013] The encrypted malicious traffic detection method of the present invention further includes: An uncertainty calibration mechanism is used to correct the probability distribution of the hierarchical classifier output, aligning the original probabilities of the model output with its true confidence level. The specific method is as follows: Introduce a learnable temperature parameter It learns by minimizing the negative log-likelihood loss on the validation set; let the validation set contain The nth sample, the nth The true label for each sample is The model outputs a logical value vector as follows: The calibration probability vector is Then the learned representation of the temperature parameter is: ;in, Indicates sample In its true label The calibrated probability by category. When making predictions, for any class of logistic vectors... The calibration probability is expressed as: For each sample, define its prediction confidence score. The maximum probability value in the calibrated probability vector is denoted as: Set a high confidence threshold and low confidence threshold ;when When the prediction results are in a certain state, they can be directly trusted and processed automatically; when... When the prediction result is marked as "low confidence", the sample is sent to the manual analysis queue for verification.

[0014] The present invention also provides an encrypted malicious traffic detection system for implementing the encrypted malicious traffic detection method described above. The system includes a data acquisition layer, a model inference layer, and a decision output layer. The data acquisition layer is used to acquire encrypted traffic data in real time and perform session segmentation on the acquired traffic data packets; for each session, the packet length sequence and arrival time interval sequence are extracted in chronological order, and a fixed-length time series matrix is ​​output; continuous wavelet transform is performed on the standardized packet length sequence to generate a time-frequency energy distribution map and a frequency band energy sequence; The model inference layer is used to extract temporal feature vectors from the original temporal matrix using a temporal convolutional network based on dilated causal convolution. Through a dual-branch structure of time-frequency attention and frequency band rescaling attention, the time-frequency energy distribution map and frequency band energy sequence are calculated respectively to obtain the frequency domain feature vector. The temporal feature vector and the frequency domain feature vector are then fused to obtain the time-frequency aggregated feature vector. The decision output layer is used to determine the type and assess the confidence level of the time-frequency aggregated feature vector.

[0015] The present invention also provides a computer-readable storage medium storing a computer program that, when executed by one or more processors, implements the encrypted malicious traffic detection method described above.

[0016] This invention offers the following advantages: The encrypted malicious traffic detection method of this invention acquires raw network traffic data, constructs packet length sequences and packet arrival time interval sequences to form an original time-series matrix. Time-frequency energy distribution maps and frequency band energy sequences are extracted from the packet length sequences using continuous wavelet transform. A time-domain temporal convolutional network based on an extended causal convolutional structure is employed to extract temporal feature vectors from the original time-series matrix. Time-frequency attention and frequency band rescaling attention modules are used to extract frequency domain feature vectors from the time-frequency energy distribution maps and frequency band energy sequences. A hierarchical classifier performs binary classification of malicious traffic and multi-classification of malicious traffic behavior types on the time-frequency aggregated feature vectors, outputting the classification results. This invention simultaneously represents features from both the time and frequency domain perspectives, designing a parallel processing structure of a time-domain temporal convolutional network and a frequency domain enhancement channel. The time-domain temporal convolutional network channel, based on an extended causal convolutional structure, extracts long-term temporal dependencies from the original time-series matrix without sacrificing temporal causality. The frequency domain enhancement channel, based on time-frequency attention and frequency band rescaling attention modules, captures key frequency domain patterns from time-frequency energy distribution maps and frequency band energy sequences. It adaptively focuses on the time-frequency regions and key frequency bands that are most discriminative for classification, suppressing noise interference and enhancing the semantic expressive power of frequency domain features. This invention significantly improves the feature representation ability and the detection accuracy of malicious encrypted traffic. Attached Figure Description

[0017] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this invention, illustrate exemplary embodiments of the invention and are used to explain the invention, but do not constitute an undue limitation of the invention. In the drawings: Figure 1 This is a schematic diagram illustrating the steps of the encrypted malicious traffic detection method provided in an embodiment of the present invention.

[0018] Figure 2 This is a schematic diagram of the network structure of a time-frequency enhanced temporal convolutional network provided in an embodiment of the present invention.

[0019] Figure 3 This is a schematic diagram of the functional modules of the encrypted malicious traffic detection system provided in an embodiment of the present invention.

[0020] Figure 4 This is a system framework diagram of the encrypted malicious traffic detection system provided in an embodiment of the present invention. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0022] The embodiments of the present invention will now be described in further detail with reference to the accompanying drawings. It should be understood that the embodiments described herein are for illustrative and explanatory purposes only and are not intended to limit the scope of the invention.

[0023] This invention is applicable to the identification and classification of encrypted malicious traffic, such as identifying malicious traffic involving data breaches and ransomware. The solution of this invention does not depend on the specific content of any particular encryption protocol and is applicable to various encrypted communication protocols.

[0024] Figure 1 This is a schematic diagram illustrating the steps of an encrypted malicious traffic detection method provided in an embodiment of the present invention. Figure 1 As shown in the figure, this embodiment of the invention provides a method for detecting encrypted malicious traffic, the method comprising the following steps: Step S1: Obtain raw network traffic data, perform data preprocessing and session serialization, construct packet length sequence and packet arrival time interval sequence to form the original time series matrix; extract time-frequency energy distribution map and frequency band energy sequence from the packet length sequence through continuous wavelet transform.

[0025] In this embodiment of the invention, the specific method for performing data preprocessing and session serialization to construct packet length sequences and packet arrival time interval sequences to form the original time series matrix is ​​as follows: Key fields are extracted from the raw network traffic data, including timestamp t, source IP address src_ip, destination IP address dst_ip, source port src_port, destination port dst_port, protocol type proto, and packet length pkt_len. Let the original packet set be... Each data packet contains a 5-tuple of information: key=(src_ip, dst_ip, src_port, dst_port, proto) and a timestamp. Data packets within the same 5-tuple are sorted in ascending order of their timestamps to obtain... Calculate the time interval between adjacent data packets If the time interval is greater than the preset flow timeout threshold Session splitting will then occur at this point, with a stream timeout threshold. The settings are configured according to protocol characteristics, with a default range of 60 seconds to 300 seconds. Ultimately, the data packet sequence under this 5-tuple is divided into S session units. Each session in a session unit Include consecutive data packets Furthermore, adjacent sessions within the same session unit satisfy the intra-session continuity constraint. .

[0026] For each session Two core time series sequences were extracted: the packet length sequence. Record the length of each data packet in chronological order; packet arrival time interval sequence. Record the time difference between the arrival of adjacent data packets. To standardize the input length and adapt to model processing, a fixed sequence length is set. If the actual sequence length Fill the end of the sequence with zero values; if Extracting the first part of the sequence from the position One element, The default setting range is 200-1000. Ultimately, each session is represented as a two-dimensional time-series matrix. The first column is the packet length sequence, the second column is the arrival time interval sequence, and all sequences are standardized.

[0027] Encrypted traffic often exhibits randomness in the time domain, while in the frequency domain it may imply malicious behavior patterns such as periodicity and burstiness. In this embodiment of the invention, joint time-frequency features are extracted from the packet length sequence based on continuous wavelet transform. The specific method for extracting the time-frequency energy distribution map and frequency band energy sequence from the packet length sequence using continuous wavelet transform is as follows: Using the complex Morlet wavelet as the mother function, it is expressed as: ,in For the center frequency, Let time be the variable; let the scale set be... The corresponding frequency band range is ,scale With frequency The relationship is ,in, The wavelet center frequency, The sampling interval is [specified]. This applies to the standardized packet length sequence. Perform a continuous wavelet transform to obtain the wavelet coefficient matrix. Its matrix elements are represented as: ,in, This serves as a scale index, corresponding to different frequency scales; This is the time index, corresponding to the th in the packet length sequence. One sampling point; This represents the complex conjugate of the wavelet mother function. Taking the modulus of the wavelet coefficients yields the time-frequency energy distribution map. , represented as The time-frequency energy distribution map simultaneously represents the energy intensity of the signal at different times and frequency scales. To further compress the feature dimensions and highlight the frequency band structure, the average energy at each scale is calculated, resulting in a frequency band energy sequence. : .

[0028] The frequency band energy sequence represents the energy distribution of traffic across different frequency bands. The time-frequency energy distribution map and the frequency band energy sequence are used as inputs to the subsequent frequency domain enhancement channel. After the aforementioned time-frequency feature extraction based on continuous wavelet transform, each session ultimately corresponds to three sets of features: the original time-series matrix... Time-frequency energy distribution map and frequency band energy sequence .

[0029] This invention constructs packet length sequences and packet arrival time interval sequences from raw network traffic data to form an original time-series matrix. It then extracts the time-frequency distribution map and frequency band energy sequence from the packet length sequences using continuous wavelet transform. Simultaneously, it performs feature representation from both time and frequency domain perspectives, achieving a deep fusion of time-frequency features to characterize malicious traffic. This overcomes the limitations of most existing methods that rely solely on time-domain features, enabling a more comprehensive capture of periodic and bursty malicious behavior patterns in encrypted traffic, thus enhancing the model's characterization capabilities and detection accuracy. Even in encrypted scenarios such as TLS / SSL, packet length sequences and arrival time intervals still retain some behavioral fingerprints. Combining the time-frequency analysis capabilities of wavelet transform for these weak signals, this solution can effectively identify encrypted malicious communication without decrypting the traffic, meeting the security monitoring needs under privacy compliance requirements.

[0030] Step S2: Construct a time-frequency enhancement detection model based on the original time-series matrix, time-frequency energy distribution map, and frequency band energy sequence. The time-frequency enhancement detection model includes a time-domain convolutional network channel and a frequency domain enhancement channel. The time-domain convolutional network channel is based on a time-domain convolutional network with an extended causal convolution structure, extracting time-domain feature vectors from the original time-series matrix. The frequency domain enhancement channel is based on time-frequency attention and frequency band rescaling attention modules, extracting frequency domain feature vectors from the time-frequency energy distribution map and the frequency band energy sequence.

[0031] Figure 2 This is a schematic diagram of the network structure of a time-frequency enhanced temporal convolutional network provided in an embodiment of the present invention. Figure 2 As shown in the embodiment of the present invention, the temporal-domain temporal convolutional network channels use the original temporal matrix. As input, long-term temporal dependency features are extracted through a multi-layer temporal convolutional network (TCN). The TCN employs a temporal-domain TCN based on an dilated causal convolutional structure, ensuring that the output depends only on the current and historical inputs, meeting the causality requirements of traffic detection. Simultaneously, an exponentially increasing dilation rate is used to capture long-term temporal dependencies. The specific method for extracting temporal feature vectors from the original temporal matrix using the dilated causal convolutional network channel is as follows: The original time series matrix is ​​processed by a one-dimensional convolutional layer with a kernel size of 1. Mapping to Dimensions To form initial feature representation Specifically, it is expressed as: ; Let the temporal convolutional network have a total of Each layer consists of a dilated causal convolutional layer, a weight normalization layer, a ReLU activation function, and a DropOut layer; Layer expansion rate Set as The kernel size is fixed. For input to the first The features of a layer are represented as ,in Given the input feature dimension, the output feature of this layer is... Represented as: ,in, It is the first Layer The convolution kernel weight matrix at each position; It is the first Layer bias vector; It is the index of the current time step; It is the output feature channel index; This indicates a weight normalization operation; This is the activation function.

[0032] Simultaneously, residual connections are introduced between every two convolutional layers, passing the original input through a... After dimension matching, the convolution is added to the output of the convolutional layer, as shown below: .

[0033] go through After stacking layers of temporal convolutional networks, the output of the last layer is... Global average pooling is performed along the time dimension to aggregate the contextual information of the entire sequence, resulting in a fixed-dimensional temporal feature vector. : ,in, is the dimension of the time-domain feature vector.

[0034] In this embodiment of the invention, the frequency domain enhancement channel uses a time-frequency energy distribution map. and frequency band energy sequence As input, frequency domain features are extracted using a dual-branch structure of a time-frequency attention module and a frequency band rescaling attention module. The frequency domain enhancement channel, based on the time-frequency attention and frequency band rescaling attention modules, extracts frequency domain feature vectors from the time-frequency energy distribution map and the frequency band energy sequence using the following specific method: Time-frequency energy distribution map is processed using a time-frequency attention module. First through a Two-dimensional convolutional layer time-frequency energy distribution map Perform preliminary feature extraction: ,in, The initial number of channels is set. Then, the importance of different channels and different time-frequency positions is learned through parallel channel attention and spatial attention mechanisms, respectively. Specifically, based on the time-frequency attention module, the channel attention mechanism is used to learn the importance of features. Global average pooling and global max pooling are performed along the time-frequency dimension to obtain two different channel description vectors. and : .

[0035] Input the two channel description vectors into a shared multilayer perceptron, and output the channel attention weights. , represented as ,in The channel attention weights are applied to the initial time-frequency energy distribution map features, using the Sigmoid function. : .

[0036] Features through spatial attention mechanism Simultaneously apply average pooling and max pooling along the channel dimension to obtain two distinct spatial feature maps, and then concatenate them: .

[0037] A spatial attention weight map is learned through a two-dimensional convolutional layer. , represented as Applying spatial attention weights: .

[0038] Finally, the enhanced time-frequency energy distribution map features Perform global average pooling to obtain the feature vector of the time-frequency attention module branch: .

[0039] Band energy sequences are processed using a band rescaling attention module. First, the frequency band energy sequence is rescaled using a learnable frequency band rescaling method to adaptively adjust the importance of each frequency band, as shown below: ;in, These are trainable parameters.

[0040] A frequency band attention mechanism is introduced to focus on key frequency bands, and a fully connected layer maps the rescaled sequence into query, key, and value vectors: ;in, Both are learnable weight matrices and bias vectors.

[0041] Calculate the attention weights for each frequency band: ;in, The vector dimension is used. The feature vectors of the frequency band rescaling attention module branches are obtained through weighted aggregation: ;in, It is the output dimension of the value vector.

[0042] Branch features of the time-frequency attention module Frequency band rescaling attention module branch features Projected to the same dimension : .

[0043] The above feature vectors are weighted and fused to calculate the fusion weight of the two branches: ;in, It is a learnable weight vector, and .

[0044] The final weighted fusion yields the frequency domain feature vector. : .

[0045] Step S3: Fuse the time-domain feature vector and the frequency-domain feature vector to obtain a time-frequency aggregated feature vector.

[0046] In this embodiment of the invention, the specific method for fusing the time-domain feature vector and the frequency-domain feature vector to obtain the time-frequency aggregated feature vector is as follows: First, the time-domain feature vector and the frequency domain feature vector spliced ​​together : Then, a gated vector is generated through a fully connected layer. : ;in It is the Sigmoid function. These are learnable parameters. It is the feature dimension after fusion. The temporal feature vector... and frequency domain eigenvectors Dimension matching is performed through a linear layer. Dimension, output is represented as and We use gated vectors to perform weighted fusion to obtain a fused feature vector. : To capture multiple timescale patterns in encrypted malicious traffic, a multi-scale pyramid convolution is employed for feature fusion. Three parallel one-dimensional convolutional branches are constructed, with their dilation rates set to... The different receptive field sizes are represented as follows: ;in This refers to the kernel size of each branch. The output features of the three branches are concatenated along the channel dimension to obtain the final time-frequency aggregated feature vector output by the time-frequency enhanced temporal convolutional network. : ;in It is the total dimension of the features after splicing.

[0047] This invention designs a parallel processing structure of a temporal-domain convolutional network and a frequency-domain enhancement channel, which is beneficial for the accurate extraction and learning of time-frequency features. The temporal-domain convolutional network channel, based on an extended causal convolutional network, extracts long-term temporal dependencies from the original temporal matrix without sacrificing temporal causality. The frequency-domain enhancement channel, based on time-frequency attention and frequency band rescaling attention modules, captures key frequency-domain patterns from the time-frequency energy distribution map and frequency band energy sequence, adaptively focusing on the most discriminative time-frequency regions and key frequency bands for classification, suppressing noise interference, and improving the semantic expressive power of frequency-domain features. Furthermore, adaptive gating fusion and multi-scale pyramid aggregation mechanisms are introduced for feature fusion, further improving the feature representation ability and detection accuracy. In addition, starting from the original traffic data, this invention automatically mines high-dimensional, nonlinear, and cross-domain discriminative features through joint optimization of wavelet transform and deep neural networks, breaking away from the dependence of traditional methods on expert-designed statistical features and adapting to the rapid evolution of new and unknown attacks.

[0048] Step S4: The time-frequency aggregated feature vector is subjected to binary classification of malicious traffic and multi-classification of malicious traffic behavior types through a hierarchical classifier, and the classification results are output.

[0049] In this embodiment of the invention, the hierarchical classifier receives the time-frequency aggregated feature vector finally output by the time-frequency enhanced temporal convolutional network. This not only performs binary classification of "normal" and "malicious" traffic, but also further performs multi-classification of specific types of malicious traffic behavior, including ransomware, botnets, mining trojans, and data leaks. The specific method for performing binary classification of malicious traffic and multi-classification of malicious traffic behavior types using a hierarchical classifier on the time-frequency feature vector, and outputting the classification results, is as follows: The hierarchical classifier's network structure consists of a shared feature extraction layer and two classification heads. The first-level classification head performs binary classification, while the second-level classification head further classifies traffic deemed "malicious" by the first level into its specific type. The shared feature extraction layer includes a fully connected layer, a ReLU activation function, and a DropOut layer, a time-frequency aggregated feature vector. As input, it is represented as: ;in, Here are the weight matrix and bias vector. The classification head consists of a fully connected layer and a Softmax activation function. The first-level classification head outputs a binary classification probability vector, represented as: The second-level classification header outputs one... Class probability vector, The total number of malicious types is represented as: Let the probability vector output by the first-level classifier be... ,in The probability is for the "normal" class. The probability is for the "malicious" class; the second-level classification head outputs the probability vector as follows: ,correspond One malicious type. The final encrypted malicious traffic prediction label is determined by the following rules: .

[0050] In this embodiment of the invention, the encrypted malicious traffic detection method further includes: An uncertainty calibration mechanism is used to correct the probability distribution of the hierarchical classifier output, aligning the original probabilities of the model output with its true confidence level. The specific method is as follows: Temperature scaling is used as a post-processing calibration method, introducing a learnable temperature parameter. It learns by minimizing the negative log-likelihood loss on the validation set. Let the validation set contain... The nth sample, the nth The true label for each sample is The model outputs a logical value vector as follows: The calibration probability vector is Then the learned representation of the temperature parameter is: ;in, Indicates sample In its true label The calibrated probability by category. When making predictions, for any class of logistic vectors... The calibration probability is expressed as: For each sample, define its prediction confidence score. The maximum probability value in the calibrated probability vector is denoted as: Further decision support is provided based on calibration by setting high confidence thresholds. and low confidence threshold ;when When the prediction results are in a certain state, they can be directly trusted and processed automatically; when... When the prediction result is marked as "low confidence", the sample is sent to the manual analysis queue for verification.

[0051] This invention designs a hierarchical classifier based on uncertainty calibration to achieve binary classification of malicious traffic and multi-classification of malicious traffic behavior types. Furthermore, it calibrates the probability distribution of the classifier output using a temperature scaling method, aligning the confidence level of the model output with its actual accuracy. Combined with high / low confidence thresholds, it further provides decision support, thereby improving the accuracy and reliability of the detection results.

[0052] Figure 3 This is a schematic diagram of the functional modules of the encrypted malicious traffic detection system provided in an embodiment of the present invention. Figure 4 This is a system framework diagram of the encrypted malicious traffic detection system provided in an embodiment of the present invention. Figure 3 , Figure 4 As shown in the figure, this embodiment of the invention also provides an encrypted malicious traffic detection system for implementing the encrypted malicious traffic detection method described above. The system comprises four subsystems: a traffic acquisition and feature construction subsystem, a time-frequency enhancement detection model subsystem, a classification decision and calibration subsystem, and a system control and interaction subsystem. The system adopts a layered architecture design, consisting of a data acquisition layer, a model inference layer, a decision output layer, and a system interaction layer from bottom to top, achieving fully automated detection from raw traffic data acquisition to malicious traffic detection result output. The functional modules of each subsystem are as follows: Figure 3 As shown, the system framework is as follows: Figure 4 As shown in the figure. The encrypted malicious traffic detection system provided in this embodiment of the invention can be deployed in enterprise egress gateways, core switches, etc.

[0053] The traffic acquisition and feature construction subsystem, located at the data acquisition layer, is responsible for collecting encrypted traffic data from the network environment in real time and constructing structured features suitable for subsequent model processing. Specifically, it includes the following modules: (1) Traffic Acquisition Module: This module collects network data packets in real time by deploying traffic mirroring probes at key network nodes or by connecting to existing security log platforms. The module supports the parsing of multiple network protocols and has mechanisms such as data buffering, field extraction, and compressed transmission to ensure the integrity and real-time performance of the collected data.

[0054] (2) Session and Sequence Construction Module: This module receives the raw data packet stream output by the traffic acquisition module and performs session segmentation based on the five-tuple (source IP, destination IP, source port, destination port, protocol) and the preset flow timeout threshold. For each session, the packet length sequence and arrival time interval sequence are extracted in chronological order, and a fixed-length time series matrix is ​​output.

[0055] (3) Time-frequency feature extraction module: This module performs continuous wavelet transform on the standardized packet length sequence to generate a time-frequency energy distribution map and a frequency band energy sequence. Combined with the original time series matrix, these form multi-dimensional time-frequency features describing traffic behavior. The module supports parallel computing and feature caching to ensure the timeliness of feature extraction.

[0056] The time-frequency enhancement detection model subsystem is the core detection engine of the encrypted malicious traffic detection system. Located in the model inference layer, it implements a time-frequency enhancement temporal convolutional network based on a deep learning framework. Specifically, it includes the following modules: (1) Time-Frequency Channel Module: This module implements a time-domain temporal convolutional network based on dilated causal convolution, used to extract long-term temporal dependency features from the original temporal matrix. The module supports multi-layer stacking and residual connections to ensure efficient modeling of long sequences.

[0057] (2) Frequency Domain Enhancement Channel Module: This module implements a dual-branch structure of time-frequency attention and frequency band rescaling attention, which respectively process the time-frequency energy distribution map and the frequency band energy sequence to capture key patterns in the frequency domain. The module adaptively adjusts the importance of different time-frequency regions through a learnable attention mechanism.

[0058] (3) Adaptive fusion module: This module receives the feature vectors output from the time domain channel and the frequency domain channel, calculates the fusion weights through a gated fusion mechanism, and realizes the dynamic fusion of time domain and frequency domain features. The fused features are further aggregated through multi-scale pyramid convolution to enhance the perception capability of different time scale patterns.

[0059] The classification decision and calibration subsystem is located at the decision output layer and is responsible for making the final judgment and confidence assessment on the time-frequency aggregated feature vector output by the model. Specifically, it includes the following modules: (1) Hierarchical classifier module: This module implements a shared feature extraction layer and a multi-task classification head structure. The first-level classification head performs a binary classification of "normal / malicious", and the second-level classification head further subdivides the traffic determined to be malicious into its specific type (such as ransomware, botnets, etc.).

[0060] (2) Uncertainty Calibration Module: This module uses temperature scaling to calibrate the original probability distribution output by the classifier, aligning the predicted probability with the true confidence level. The module outputs the calibrated probability and confidence score for each sample and supports classifying the detection results according to preset high and low confidence thresholds.

[0061] The system management and interaction subsystem resides in the human-computer interaction layer, providing functions for system operation management, status monitoring, and manual collaborative handling. Specifically, it includes the following modules: (1) System Configuration Management Module: This module provides a web management interface for system administrators to perform global configurations, including data source management, model parameter adjustment, and model version management. At the same time, it collects and displays key indicators such as system operating status, resource utilization, and detection accuracy in real time.

[0062] (2) Human-computer interaction module: This module provides a visual dashboard that displays structured malicious traffic alarm events with confidence scores. Security operations and maintenance personnel can manually review alarms, mark false alarms / missed alarms, add handling opinions through the interface, and review low-confidence samples.

[0063] This invention also provides a computer-readable storage medium storing a computer program that, when executed by one or more processors, implements the encrypted malicious traffic detection method described above.

[0064] The above are merely specific embodiments of the present invention and should not be construed as limiting the scope of the present invention. Equivalent variations made by those skilled in the art based on this invention, as well as changes well-known to those skilled in the art, should still fall within the scope of the present invention.

Claims

1. A method for detecting encrypted malicious traffic, characterized in that, The method includes the following steps: The raw network traffic data is acquired, preprocessed, and serialized to construct packet length sequences and packet arrival time interval sequences to form the original time series matrix; the time-frequency energy distribution map and frequency band energy sequence are extracted from the packet length sequences through continuous wavelet transform. A time-frequency enhancement detection model is constructed based on the original time-series matrix, time-frequency energy distribution map, and frequency band energy sequence. The time-frequency enhancement detection model includes a time-domain temporal convolutional network channel and a frequency domain enhancement channel. The time-domain temporal convolutional network channel is based on a time-domain temporal convolutional network with an extended causal convolutional structure to extract time-domain feature vectors from the original time-series matrix. The frequency domain enhancement channel is based on time-frequency attention and frequency band rescaling attention modules to extract frequency domain feature vectors from the time-frequency energy distribution map and the frequency band energy sequence. The time-domain feature vector and the frequency-domain feature vector are fused to obtain a time-frequency aggregated feature vector; The time-frequency aggregated feature vector is processed by a hierarchical classifier to perform binary classification of malicious traffic and multi-class classification of malicious traffic behavior types, and the classification results are output.

2. The encrypted malicious traffic detection method according to claim 1, characterized in that, The specific method for performing data preprocessing and session serialization to construct packet length sequences and packet arrival time interval sequences to form the original time series matrix is ​​as follows: Key fields are extracted from the raw network traffic data, including timestamp, source IP address, destination IP address, source port, destination port, protocol type, and packet length. Each raw data packet contains a 5-tuple and a timestamp; The 5-tuple information includes: source IP address, destination IP address, source port, destination port, and protocol type. Data packets under the same 5-tuple are arranged in ascending order of timestamps. The time interval between adjacent data packets is calculated. If the time interval is greater than a preset flow timeout threshold, session segmentation is performed at this point. Finally, the data packet sequence under the 5-tuple is divided into multiple session units. Each session in a session unit contains multiple consecutive data packets, and adjacent sessions within the same session unit satisfy the intra-session continuity constraint. For each session, extract the packet-length sequence. Packet arrival time interval sequence To standardize input length and adapt to model processing, a fixed sequence length is set. If the actual sequence length Fill the end of the sequence with zero values; if Extracting the first part of the sequence from the position Each session is represented by an element; ultimately, each session is represented as a two-dimensional time-series matrix. The first column is the packet length sequence, the second column is the arrival time interval sequence, and all sequences are standardized.

3. The encrypted malicious traffic detection method according to claim 2, characterized in that, The specific method for extracting the time-frequency energy distribution map and the frequency band energy sequence from the packet length sequence through continuous wavelet transform is as follows: Using the complex Morlet wavelet as the mother function, it is expressed as: ,in For the center frequency, Let time be the variable; let the scale set be... The corresponding frequency band range is ,scale With frequency The relationship is ,in, The wavelet center frequency, The sampling interval; For the standardized packet length sequence Perform a continuous wavelet transform to obtain the wavelet coefficient matrix. Its matrix elements are represented as: ， in, This serves as a scale index, corresponding to different frequency scales; This is the time index, corresponding to the th in the packet length sequence. One sampling point; Represents the complex conjugate of the wavelet mother function; By taking the modulus of the wavelet coefficients, the time-frequency energy distribution map is obtained. , represented as ; Calculate the average energy at each scale to obtain the frequency band energy sequence. : 。 4. The encrypted malicious traffic detection method according to claim 3, characterized in that, The temporal-domain convolutional network channel is based on a dilated causal convolutional structure. The specific method for extracting temporal feature vectors from the original temporal matrix is ​​as follows: The original time series matrix is ​​processed by a one-dimensional convolutional layer with a kernel size of 1. Mapping to Dimensions To form initial feature representation Specifically, it is expressed as: ； Let the temporal convolutional network have a total of Each layer consists of a dilated causal convolutional layer, a weight normalization layer, a ReLU activation function, and a DropOut layer; Layer expansion rate Set as The kernel size is fixed. For input to the first The features of a layer are represented as ,in Given the input feature dimension, the output feature of this layer is... Represented as: ,in, It is the first Layer The convolution kernel weight matrix at each position; It is the first Layer bias vector; It is the index of the current time step; It is the output feature channel index; This indicates a weight normalization operation; For activation functions; Simultaneously, residual connections are introduced between every two convolutional layers, passing the original input through a... After dimension matching, the convolution is added to the output of the convolutional layer, as shown below: ; go through After stacking layers of temporal convolutional networks, the output of the last layer is... Global average pooling is performed along the time dimension to aggregate the contextual information of the entire sequence, resulting in a fixed-dimensional temporal feature vector. : ,in, is the dimension of the time-domain feature vector.

5. The encrypted malicious traffic detection method according to claim 4, characterized in that, The frequency domain enhancement channel, based on time-frequency attention and frequency band rescaling attention modules, extracts frequency domain feature vectors from the time-frequency energy distribution map and the frequency band energy sequence using the following specific method: Through a Two-dimensional convolutional layer time-frequency energy distribution map Perform preliminary feature extraction: ,in, This represents the initial number of channels; Based on the time-frequency attention module, features are processed through a channel attention mechanism. Global average pooling and global max pooling are performed along the time-frequency dimension to obtain two different channel description vectors. and : ； Input the two channel description vectors into a shared multilayer perceptron, and output the channel attention weights. , represented as ,in The channel attention weights are applied to the initial time-frequency energy distribution map features, using the Sigmoid function. : ; Features through spatial attention mechanism Simultaneously apply average pooling and max pooling along the channel dimension to obtain two distinct spatial feature maps, and then concatenate them: ； A spatial attention weight map is learned through a two-dimensional convolutional layer. , represented as Spatial attention weights are applied. ; Features of the enhanced time-frequency energy distribution map Perform global average pooling to obtain the feature vector of the time-frequency attention module branch: ; Learnable band rescaling of the frequency band energy sequence adaptively adjusts the importance of each band, as follows: ;in, These are trainable parameters; The rescaled sequence is mapped to a vector of queries, keys, and values ​​using a fully connected layer: ； in, Both are learnable weight matrices and bias vectors; Calculate the attention weights for each frequency band: ;in, Given a vector dimension; the feature vectors of the frequency band rescaling attention module branches are obtained through weighted aggregation: ;in, It is the output dimension of the value vector; Branch features of the time-frequency attention module Frequency band rescaling attention module branch features Projected to the same dimension : ; The above feature vectors are weighted and fused to calculate the fusion weight of the two branches: ;in, It is a learnable weight vector, and ; The final weighted fusion yields the frequency domain feature vector. : .

6. The encrypted malicious traffic detection method according to claim 5, characterized in that, The specific method for fusing the time-domain feature vector and the frequency-domain feature vector to obtain the time-frequency aggregated feature vector is as follows: The time-domain feature vector and the frequency domain feature vector spliced ​​together : ; A gate vector is generated through a fully connected layer. : ;in It is the Sigmoid function. These are learnable parameters. It is the feature dimension after fusion; Time-domain feature vectors and frequency domain eigenvectors Dimension matching is performed through a linear layer. Dimension, output is represented as and ; Weighted fusion is performed using gated vectors to obtain the fused feature vector. : ; Construct three parallel one-dimensional convolutional branches, with their dilation rates set to... The different receptive field sizes are represented as follows: ;in This refers to the kernel size of each branch; the output features of the three branches are concatenated along the channel dimension to obtain the final time-frequency aggregated feature vector output by the time-frequency enhanced temporal convolutional network. : ;in It is the total dimension of the features after splicing.

7. The encrypted malicious traffic detection method according to claim 6, characterized in that, The specific method for performing binary classification of malicious traffic and multi-classification of malicious traffic behavior types on the time-frequency feature vector using a hierarchical classifier, and outputting the classification results, is as follows: The hierarchical classifier's network structure consists of a shared feature extraction layer and two classification heads. The first-level classification head performs binary classification, while the second-level classification head further classifies traffic deemed "malicious" by the first-level classification head into its specific type. The shared feature extraction layer includes a fully connected layer, a ReLU activation function, and a DropOut layer, which aggregates time-frequency feature vectors. As input, it is represented as: ;in, These are the weight matrix and the bias vector; The classification head consists of a fully connected layer and a Softmax activation function. The first-level classification head outputs a binary classification probability vector, represented as: The second-level classification header outputs one... Class probability vector, The total number of malicious types is represented as: Let the output probability vector of the first-level classifier be... ,in The probability is for the "normal" class. The probability is for the "malicious" class; the second-level classification head outputs the probability vector as follows: ,correspond One malicious type; the final encrypted malicious traffic prediction label is determined by the following rules: 。 8. The method for detecting encrypted malicious traffic according to claim 1, characterized in that, The encrypted malicious traffic detection method also includes: An uncertainty calibration mechanism is used to correct the probability distribution of the hierarchical classifier output, aligning the original probabilities of the model output with its true confidence level. The specific method is as follows: Introduce a learnable temperature parameter It learns by minimizing the negative log-likelihood loss on the validation set; let the validation set contain The nth sample, the nth The true label for each sample is The model outputs a logical value vector as follows: The calibration probability vector is Then the learned representation of the temperature parameter is: ;in, Indicates sample In its true label Calibrated probabilities for each category; When making predictions, for any type of logical vector The calibration probability is expressed as: For each sample, define its prediction confidence score. The maximum probability value in the calibrated probability vector is denoted as: Set a high confidence threshold and low confidence threshold ;when When the prediction results are in a certain state, they can be directly trusted and processed automatically; when... When the prediction result is marked as "low confidence", the sample is sent to the manual analysis queue for verification.

9. An encrypted malicious traffic detection system, used to implement the encrypted malicious traffic detection method as described in any one of claims 1-8, characterized in that, The system includes a data acquisition layer, a model inference layer, and a decision output layer. The data acquisition layer is used to acquire encrypted traffic data in real time and perform session segmentation on the acquired traffic data packets; for each session, the packet length sequence and arrival time interval sequence are extracted in chronological order, and a fixed-length time series matrix is ​​output; continuous wavelet transform is performed on the standardized packet length sequence to generate a time-frequency energy distribution map and a frequency band energy sequence; The model inference layer is used to extract temporal feature vectors from the original temporal matrix using a temporal convolutional network based on dilated causal convolution. Through a dual-branch structure of time-frequency attention and frequency band rescaling attention, the time-frequency energy distribution map and frequency band energy sequence are calculated respectively to obtain the frequency domain feature vector. The temporal feature vector and the frequency domain feature vector are then fused to obtain the time-frequency aggregated feature vector. The decision output layer is used to determine the type and assess the confidence level of the time-frequency aggregated feature vector.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by one or more processors, implements the encrypted malicious traffic detection method as described in any one of claims 1-8.

Images